bundlewrap/bundles/sshmon/files/check_https_certificate_at_url

45 lines
1.4 KiB
Bash

#!/bin/bash
host=$1
port=$2
cert=$(echo | openssl s_client -connect "$host":"$port" -servername "$host" 2>/dev/null | openssl x509)
issuer_hash=$(echo "$cert" | openssl x509 -noout -issuer_hash)
not_after=$(echo "$cert" | openssl x509 -noout -dates | grep '^notAfter=')
if [[ -z "$cert" ]] || [[ -z "$issuer_hash" ]] || [[ -z "$not_after" ]]
then
echo "UNKNOWN - Could not retrieve certificate! [$host:$port]"
exit 3
fi
warn_days=60
crit_days=30
case "$issuer_hash" in
# 4f06f81d: issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
# 8d33f237: issuer=C = US, O = Let's Encrypt, CN = R3
# 462422cf: issuer=C = US, O = Let's Encrypt, CN = E5
# 9aad238c: issuer=C = US, O = Let's Encrypt, CN = E6
4f06f81d|8d33f237|462422cf|9aad238c)
warn_days=10
crit_days=3
;;
esac
if ! echo "$cert" | openssl x509 -noout -checkend 0 >/dev/null 2>&1
then
echo "CRITICAL - Certificate has expired! [$host:$port] [$not_after]"
exit 2
elif ! echo "$cert" | openssl x509 -noout -checkend $((86400 * crit_days)) >/dev/null 2>&1
then
echo "CRITICAL - Certificate will expire really soon: [$host:$port] [$not_after]"
exit 2
elif ! echo "$cert" | openssl x509 -noout -checkend $((86400 * warn_days)) >/dev/null 2>&1
then
echo "WARNING - Certificate will expire soon: [$host:$port] [$not_after]"
exit 1
fi
echo "OK - [$host:$port] [$not_after]"
exit 0